[bokelley]

Authenticated native sealed-session bearers currently reach organization resolution after middleware authentication and are rejected as invalid organization-bearing JWT/API-key credentials. This narrow follow-up records authenticated sealed-bearer transport provenance in middleware and lets the organization helper consume that exact snapshot only when the presented token and snapshot still match. Existing explicit organization selectors continue through exact-credential direct membership or valid explicit credential grants.

No implicit organization fallback is restored for zero, one, or many organizations. Primary-org, sole-org, canonical-sibling, and email authority are not inferred. Cookie behavior and the deliberate Addie sole-org behavior in member-context are unchanged. Scope is limited to the two authentication files and one regression suite below; no migration or reservation, grant-policy change, or unrelated topology change.

DRAFT / readiness and deployment blocked. The existing optionalAuth sealed-session platform-ban omission is a separate High blocker, now being fixed separately from main. This PR must be rebased/composed after that fix before readiness or deployment, followed by fresh review and exact-head CI. This publication preserves the reviewed blobs and performs no rebase. Human maintainer approval is required; requesting review or receiving bot review is not approval. This is one #6827 slice only, not issue closure or a merge-ready claim.

Exact stack and reviewed candidate

Stack: #7462 -> #7461 -> #7477 -> this draft.

Base branch: conductor/addie-explicit-organization (the exact branch of #7477, not main).

Artifact	Exact value
Parent / #7477 head / publication base SHA	3e5b6c7159327d6731ec88eb412c7cf6e080ba36
Candidate HEAD	0734eb014e56887f30f925d11a74b74c7cca98d7
Independently reviewed candidate tree	d8dbeca51d30d4d0535c1f1fba981837c86bd514
#7461 head beneath #7477	6cb4b16fb2bdd83ace7beb2b414e9fc6b5f09998

One commit: fix(auth): preserve sealed bearer organization selection.

Three files, 509 additions / 10 deletions (production source: 47 additions / 10 deletions):

File	Delta	Purpose
server/src/middleware/auth.ts	+25 / -1	Typed, non-enumerable, frozen request provenance binding the bearer hash to its exact fresh snapshot; set only in successful required/optional sealed-session cache miss/hit paths.
server/src/routes/helpers/resolve-caller-org.ts	+22 / -9	Verify token/snapshot provenance before sharing the existing explicit sealed-session organization checks.
server/tests/integration/sealed-bearer-organization.test.ts	+462 / -0	197 mounted HTTP regressions using real middleware and PostgreSQL authorization SQL; tests never manufacture trusted provenance.

Local evidence on the reviewed tree

• Focused auth unit suites: 388 passed / 5 files.
• Affected PostgreSQL integration suites: 232 passed / 4 files, including all 197 new mounted cases. Real repository Docker PostgreSQL 16.15 service; existing migrations only. WorkOS authentication and membership transport are mocked.
• npm run precommit: passed. Root Vitest: 1,063 passed / 71 files, plus 50 Node guard/vector checks. Full server units: 9,957 passed, 31 intentionally skipped / 619 files. Repository typecheck, including fixed-trace rollout checks, passed.
• New integration-file typecheck with repository ambient augmentations: passed. npm run test:migrations: 3 passed. Image guard and diff whitespace checks passed.
• Four representative required/optional cache miss/hit regressions fail with the original 401 behavior on an untouched copy of fix(auth): require explicit organization for sealed callers #7477 source and pass on the candidate.

Mounted coverage includes no selector with zero/one/many orgs; all supported header/query/body/path selectors; exact membership and grant-only access; selector conflicts; absent, expired, future, revoked, mismatched, and sibling-only grants; inactive membership; DB/provider outages; credential deletion; snapshot/epoch/grant changes; forged HTTP fields; changed token/principal/snapshot; refreshes; concurrent cache hits; cross-cookie/bearer and required/optional cache isolation; and real conformance-token route composition.

Broad integration was not green: DATABASE_URL=<local test database> npm run test:server-integration finished with 2,325 passed / 4 failed / 8 skipped across 165 files. The failures were a community-mirror setup timeout, two registry setup/snapshot timeouts, and the creative-lifecycle webhook timeout. Full reruns of the three affected suites produced 96 passed / 2 failed out of 98; the mirror suite passed, and registry encountered another snapshot-deadline-induced public-only comparison failure. A subsequent isolated full registry run passed 45/45 without source or timeout changes.

The remaining training-agent-webhooks.test.ts:1001 creative-lifecycle webhook timeout was reproduced on the untouched published parent, using the same unchanged retained assets in a separate database: 14 passed / 1 identical 15-second timeout out of 15. No registry or training-agent code/deadlines were altered. These follow-ups do not turn the original broad run into a green run.

Skipped local lanes: 28 opt-in live Addie model scenarios plus 3 explicitly skipped schema examples in the unit suite; 7 opt-in live creative-agent comparisons plus 1 retained GCS evidence case in integration. The documentation/schema-heavy npm test monolith was not run. Live WorkOS cryptography/revocation and an actual native client were not verified.

Publication pre-push evidence: the advisory local storyboard matrix (selected by the hook against the inherited stack relative to origin/main) failed because compliance cache 3.2.0-rc.2 is unsupported by the test seller, whose advertised versions stop at 3.2-rc.1; isolated storyboard discovery also failed. The repository-documented ADCP_SKIP_STORYBOARD_MATRIX=1 override is used for draft publication, with the remaining push checks retained. The separate local 3.0 compatibility run is skipped with that matrix. This is not a passing storyboard result; authoritative CI remains required. No reviewed source or generated tracked blobs were changed.

Independent review and remaining constraints

An independent security/delta reviewer verified exact tree d8dbeca51d30d4d0535c1f1fba981837c86bd514 before and after review against the exact parent and found no introduced blocker or actionable delta finding. Review covered authorization bypass, marker forgery, token/principal confusion, cache contamination, stale authorization, optionalAuth marker/snapshot parity, sibling isolation, cookie compatibility, and scope.

The existing 60-second provider-authentication cache remains. Fresh local snapshots do not establish immediate remote WorkOS session revocation, and live WorkOS revocation was not verified. The separate High optionalAuth platform-ban blocker described above remains a prerequisite to readiness/deployment. Existing authorization-to-action timing limitations also remain.

Keep this PR in Draft with auto-merge off. Human approval and fresh CI on the eventual composed exact head are required before any readiness/deployment decision. Related to #6827; does not close it.

---

Open workspace in Conductor

Draft disposition — 2026-10-09

• Existing author: @bokelley. Existing workspace.
• Workstream / hold: Existing dependency stack; stack dependency.
• Next action: Rebase onto fix(auth): require explicit organization for sealed callers #7477 after the High sealed-session blocker is fixed; obtain fresh review and exact-head CI before deploy.

This draft is retained for the stated workstream. Continue on this existing branch; no parallel PR is needed. This disposition does not waive CI, review, migration, or release gates.